diff options
-rw-r--r-- | ncp-web/ncp-launcher.php | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/ncp-web/ncp-launcher.php b/ncp-web/ncp-launcher.php index 5e8ceafc..0b28f4c8 100644 --- a/ncp-web/ncp-launcher.php +++ b/ncp-web/ncp-launcher.php @@ -92,8 +92,12 @@ if ( $_POST['action'] == "cfgreq" ) else if ( $_POST['action'] == "launch" && $_POST['config'] ) { + // sanity checks if ( !$_POST['ref'] ) exit( '{ "output": "Invalid request" }' ); + preg_match( '/^[a-z-]+$/' , $_POST['ref'] , $matches ) + or exit( '{ "output": "Invalid input" , "token": "' . getCSRFToken() . '" }' ); + // CSRF check $token = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : ''; if ( empty($token) || !validateCSRFToken($token) ) |